Alibaba Apple ID phish
Posted by Dave Yadallee onX-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Fri, 14 Aug 2026 12:01:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))
(envelope-from
id 1wuwCZ-00000000MeO-2cxi
for dave@doctor.nl2k.ab.ca;
Fri, 14 Aug 2026 12:00:19 -0600
Resent-From: The Doctor
Resent-Date: Fri, 14 Aug 2026 12:00:19 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from system12.eu.zeptomail.net ([136.143.168.12]:17416)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384
(Exim 4.99.5 (FreeBSD))
(envelope-from
id 1wuuzV-000000001Y1-232c
for doctor@doctor.nl2k.ab.ca;
Fri, 14 Aug 2026 10:42:55 -0600
ARC-Seal: i=1; a=rsa-sha256; t=1786725655; cv=none;
d=zohomail360.eu; s=zohoarc;
b=EtjTQ8zfhqMJ2qLp0gNK2JCq3RwVAgNhtbe2zpb8VsUFThiyl7G/l7sP5tyOgx2U/wfAt9cIbpO0HWB1jLXpjaSNH1j7TfuFHiNfahno+Uc7wxklSerIv59l7ow0xtizMLbb2Dj74j7IeRZk8WLANoJjptOGRLJANAtpysuBGAA=
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail360.eu; s=zohoarc;
t=1786725655; h=Content-Type:Date:Date:From:From:MIME-Version:Message-ID:Subject:Subject:To:To:Message-Id:Reply-To:Cc;
bh=x4NfaWVVWUTMyTWJRFshGU8xQDzienDfGlsQo78b9zQ=;
b=P4Yf29mc4FmYW9sDBHdErMy+zEn34fy0yDbmOekDlol52NhgN9fD2RfD6iIf4OXk6vTaOkXmG55bcyDXDDw70Dmg++bzdqPnvEqMJC6pjbUpfOdorBzF1s51Fk/NrceocHSYzUHz9/QdB65G4fAinbR8lVDZd2YT3hJZkVhMXcQ=
ARC-Authentication-Results: i=1; mx.zohomail360.eu;
dkim=pass header.i=zohomail.eu;
spf=pass smtp.mailfrom=noreply+eb007880-97fe-11f1-9615-dad70ff08860_vt1@eu-sender.zohocalendar.com;
dmarc=pass header.from=
Received: by mx.zoho.eu with SMTPS id 1786725655292704.8023374017663;
Fri, 14 Aug 2026 18:40:55 +0200 (CEST)
DKIM-Signature: a=rsa-sha256; b=DFsvZW6oPLSxh3U5CwH8oJM/94aBcWWlR7xHCNlLhTVj1lkeB4q8Q51kBkfwBfPoEGqCHF9CNiu9mMXld64X1qRgVAfrpnVD54Nih92wlKzutNC0BzEdPeyEwvRAGBmCfUV5TApStw4Fw5Vp39R68tiwhhtyf39OEdIHJA/wCGk=; c=relaxed/relaxed; s=1522905495316; d=zohomail.eu; v=1; bh=x4NfaWVVWUTMyTWJRFshGU8xQDzienDfGlsQo78b9zQ=; h=date:from:to:message-id:subject:mime-version:content-type:date:from:to:message-id:subject;
Date: Fri, 14 Aug 2026 18:40:55 +0200 (CEST)
From: "hqyonprj.7239957"
To: doctor@doctor.nl2k.ab.ca
Message-ID:
Subject: Invitation: Thanks for your time @ Fri Aug 14, 2026 20:00 - 20:30
(Europe/Helsinki)
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----=_Part_24757064_2042309305.1786725655228"
Original-Envelope-Id: 13ef.4a81a039d.m1.eb007880-97fe-11f1-9615-dad70ff08860.1a00125e008
X-JID: 13ef.4a81a039d.m4.eb007880-97fe-11f1-9615-dad70ff08860.1a00125e008
TM-MAIL-JID: 13ef.4a81a039d.m1.eb007880-97fe-11f1-9615-dad70ff08860.1a00125e008
X-App-Message-ID: 13ef.4a81a039d.m1.eb007880-97fe-11f1-9615-dad70ff08860.1a00125e008
X-Report-Abuse:
TM-Message-ID: <13ef.4a81a039d.m1.eb007880-97fe-11f1-9615-dad70ff08860.1a00125e008@eu-sender.zohocalendar.com>
X-Zoho-Virus-Status: 1
X-Zoho-AV-Stamp: zmail-av-0.2.11.1.5.2/286.699.57
Feedback-ID: zu08031229318e8f9333570f65277591f800001bd1651b6a860adad64fe74fbf919abb62bffb8ce0be43757aaa4e:ZohoMail
X-Zoho-CM-AccountID: a9510a8bd0249f1c1db2678c8849014e366e1eeb752e42d67587ab1251b51e3a
X-ZohoMailClient: External
------=_Part_24757064_2042309305.1786725655228
Content-Type: multipart/alternative;
boundary="----=_Part_24757068_805811222.1786725655228"
------=_Part_24757068_805811222.1786725655228
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
------=_Part_24757068_805811222.1786725655228
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/x=
html1/DTD/xhtml1-transitional.dtd">
" />
=3D"
margin: 0px auto;
width: 540px;
border-width: 1px;
border-style: solid;
font-family: inherit;
font-size: 14px;
text-decoration: none;
table-layout: fixed;
word-break:normal;
">
src=3D"https://static.zohocdn.com/calendar/email-te=
mplate-assets/calendar-header-doodle-v1.png"
width=3D"100%"
height=3D"100%"
/>
px; padding: 0 30px; background-size: 100%">
th: 100%; border-collapse: collapse">
=3D"margin: 0; line-height: 21px">
f=3D"mailto:hqyonprj.7239957@zohomail.eu"
style=3D"text-decoration: none"=
>
hqyonprj.7239957@zohomail.eu
invites you to be a part of Thanks =
for your time
e=3D"
font-size: 20px;
margin: 0;
line-height: 23px;
font-weight: 500;
padding: 10px 0px 24px;
word-break: break-word;
">
Thanks for your time
lapse: collapse" cellspacing=3D"0"
cellpadding=3D"0">
ertical-align: middle">
style=3D"
display: inline-blo=
ck;
padding-right: 10px=
;
width: 14px;
height: 14px;
vertical-align: -2p=
x;
">
tic.zohocdn.com/calendar/email-template-assets/icon-time-v1.png"
width=3D"14" height=
=3D"14"/>
class=3D"zclet__event__=
label"
style=3D"display: inlin=
e-block;font-size: 14px;line-height: 16px">
Date and time
x 24px">
lapse: collapse" cellspacing=3D"0"
cellpadding=3D"0">
/td>
vent__text"
style=3D"font-size: 16p=
x; line-height: 19px">
Fri Aug 14, 2026 20:00 =
- 20:30 (Europe/Helsinki)=20
">
lapse: collapse" cellspacing=3D"0"
cellpadding=3D"0">
display=
: inline-block;
padding=
-right: 10px;
width: =
10px;
height:=
10px;
">
tic.zohocdn.com/calendar/email-template-assets/icon-notes-v1.png"
width=3D"10" height=
=3D"10">
display=
: inline-block;
font-si=
ze: 14px;
line-he=
ight: 16px;
" class=3D"=
zclet__event__label">
Description
x 24px">
lapse: collapse" cellspacing=3D"0"
cellpadding=3D"0">
/td>
font-si=
ze: 14px;
line-he=
ight: 21px;
margin:=
0;
word-br=
eak: break-word;
" class=3D"=
zclet__event__text">
Notice =E2=80=93=
Suspicious Activity Detected on Your Apple Account
Dear Customer,=
p>
We have identified a $199 transaction on your Apple ID that appears a=
bnormal.
Transaction Details:
Purchase attempted through Alibaba=
.com (not your usual activity)
As a precaution, this transaction has=
been temporarily placed on hold.
We also detected a login attempt from=
an unfamiliar device and location.
If you recognize this transactio=
n =E2=80=93 no further action is required.
If not recognized =E2=80=93 =
your account will be charged within the next hour.
Please contact Apple=
Support immediately at +1 (803) 239-9728
to cancel or=
dispute the transaction.
Apple Security & Billing Team:
>+1 (803) 239-9728
=C2=A9=EF=B8=8F 2026 Apple Inc
&n=
bsp;
g: 0 0px 20px; margin-top: 6px">
/zc/ui/public/invitation/#akey=3Dzz08011230bada1da45d39bb980048095b29c6ae38=
6935edbdda3a641cc4b7951605bdb988ac4629abd563774ebb298099a3da6fb9&eid=3Dzz08=
011230e62487e4144371b3020247b78637088de266b35677195a84292d071f2df7d6d9d0722=
9bae028e1b886995f95aab21480&calid=3Dzz0801122085ab4d5f6491d2d5bee20aba3ff64=
4465713a7a94e059f6a8ab9f8b5752d2df2" style=3D"
text-decoration: no=
ne;
display: inline-blo=
ck;
margin-right: 20px;
padding: 10px 16px;
border-radius: 4px;
line-height: 16px;
font-size: 14px;
" class=3D"zclet__actio=
n--filled">
View event
let__container__separator">
und-size: 100%; background-position: 0px 100%">
th: 100%; border-collapse: collapse"
cellspacing=3D"0" cellpadding=3D"0">
display: inline-block;
margin-right: 10px;
width: 38px;
height: 38px;
">
calendar/email-template-assets/calendar-logo-v1.png"
style=3D"width: 38px; height: 33px"=
>
17px" class=3D"zclet__footer__text">
This calendar notification email wa=
s sent from Zoho Calendar by
" class=3D"zclet__link" style=3D"text-decoration: none; color: #004ce6">hqy=
onprj.7239957@zohomail.eu. If you believe this to be spam or junk, plea=
se report this email to
t__link" style=3D"text-decoration: none; color: #004ce6">abuse@zohocorp.com=
et__footer__text">
>
=C2=A9 2026, Zoho Corporation Pvt. =
Ltd. All Rights Reserved.
------=_Part_24757068_805811222.1786725655228
Content-Type: text/calendar;method=REQUEST;charset="UTF-8"
Content-Transfer-Encoding: 7bit
Content-Class: urn:content-classes:calendarmessage
Charset: UTF-8
BEGIN:VCALENDAR
PRODID:-//Zoho Corporation//Zoho Calendar-EU//EN
VERSION:2.0
X-WR-TIMEZONE:null
CALSCALE:GREGORIAN
METHOD:REQUEST
BEGIN:VTIMEZONE
TZID:Europe/Helsinki
BEGIN:DAYLIGHT
TZOFFSETFROM:+0200
TZOFFSETTO:+0300
DTSTART:19700329T030000
RRULE:FREQ=YEARLY;BYMONTH=3;BYDAY=-1SU
END:DAYLIGHT
BEGIN:STANDARD
TZOFFSETFROM:+0300
TZOFFSETTO:+0200
DTSTART:19701025T040000
RRULE:FREQ=YEARLY;BYMONTH=10;BYDAY=4SU
END:STANDARD
END:VTIMEZONE
BEGIN:VEVENT
SUMMARY:Thanks for your time
DESCRIPTION:Notice – Suspicious Activity Detected on Your Apple Account\n Dear Customer,\n We have identified a $199 transaction on your Apple ID that appears abnormal.\n Transaction Details:\nPurchase attempted through Alibaba.com (not your usual activity)\n As a precaution, this transaction has been temporarily placed on hold.\nWe also detected a login attempt from an unfamiliar device and location.\n If you recognize this transaction – no further action is required.\nIf not recognized – your account will be charged within the next hour.\nPlease contact Apple Support immediately at +1 (803) 239-9728\nto cancel or dispute the transaction.\n Apple Security & Billing Team: +1 (803) 239-9728\n Â©ï¸ 2026 Apple Inc\n \n
X-ALT-DESC;FMTTYPE=text/html:
Notice – Suspicious Activity Detected on Your Apple Account
Dear Customer,
We have identified a $199 transaction on your Apple ID that appears abnormal.
Transaction Details:
Purchase attempted through Alibaba.com (not your usual activity)
As a precaution, this transaction has been temporarily placed on hold.
We also detected a login attempt from an unfamiliar device and location.
If you recognize this transaction – no further action is required.
If not recognized – your account will be charged within the next hour.
Please contact Apple Support immediately at +1 (803) 239-9728
to cancel or dispute the transaction.
Apple Security & Billing Team: +1 (803) 239-9728
Â©ï¸ 2026 Apple Inc
DTSTART;TZID=Europe/Helsinki:20260814T200000
DTEND;TZID=Europe/Helsinki:20260814T203000
LOCATION:
UID:f28c663cc9344cd9ba7d644f9e996dd7@zoho.eu
IMPORTANT:0
CLASS:PUBLIC
STATUS:CONFIRMED
TRANSP:OPAQUE
PRIORITY:0
CREATED:20260814T164053Z
LAST-MODIFIED:20260814T164053Z
DTSTAMP:20260814T164054Z
ORGANIZER;CN=hqyonprj.7239957:MAILTO:hqyonprj.7239957@zohomail.eu
ATTENDEE;CUTYPE=INDIVIDUAL;ROLE=REQ-PARTICIPANT;RSVP=TRUE;PARTSTAT=NEEDS-ACTION:MAILTO:doctor@doctor.nl2k.ab.ca
BEGIN:VALARM
ACTION:EMAIL
TRIGGER;VALUE=DURATION;RELATED=START:-PT15M
END:VALARM
END:VEVENT
END:VCALENDAR
------=_Part_24757068_805811222.1786725655228--
------=_Part_24757064_2042309305.1786725655228
Content-Type: text/calendar; charset=UTF-8; name=event.ics
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=event.ics
QkVHSU46VkNBTEVOREFSClBST0RJRDotLy9ab2hvIENvcnBvcmF0aW9uLy9ab2hvIENhbGVuZGFy
LUVVLy9FTgpWRVJTSU9OOjIuMApYLVdSLVRJTUVaT05FOm51bGwKQ0FMU0NBTEU6R1JFR09SSUFO
Ck1FVEhPRDpSRVFVRVNUCkJFR0lOOlZUSU1FWk9ORQpUWklEOkV1cm9wZS9IZWxzaW5raQpCRUdJ
TjpEQVlMSUdIVApUWk9GRlNFVEZST006KzAyMDAKVFpPRkZTRVRUTzorMDMwMApEVFNUQVJUOjE5
NzAwMzI5VDAzMDAwMApSUlVMRTpGUkVRPVlFQVJMWTtCWU1PTlRIPTM7QllEQVk9LTFTVQpFTkQ6
REFZTElHSFQKQkVHSU46U1RBTkRBUkQKVFpPRkZTRVRGUk9NOiswMzAwClRaT0ZGU0VUVE86KzAy
MDAKRFRTVEFSVDoxOTcwMTAyNVQwNDAwMDAKUlJVTEU6RlJFUT1ZRUFSTFk7QllNT05USD0xMDtC
WURBWT00U1UKRU5EOlNUQU5EQVJECkVORDpWVElNRVpPTkUKQkVHSU46VkVWRU5UClNVTU1BUlk6
VGhhbmtzIGZvciB5b3VyIHRpbWUKREVTQ1JJUFRJT046Tm90aWNlIOKAkyBTdXNwaWNpb3VzIEFj
dGl2aXR5IERldGVjdGVkIG9uIFlvdXIgQXBwbGUgQWNjb3VudFxuIERlYXIgQ3VzdG9tZXIsXG4g
V2UgaGF2ZSBpZGVudGlmaWVkIGEgJDE5OSB0cmFuc2FjdGlvbiBvbiB5b3VyIEFwcGxlIElEIHRo
YXQgYXBwZWFycyBhYm5vcm1hbC5cbiBUcmFuc2FjdGlvbiBEZXRhaWxzOlxuUHVyY2hhc2UgYXR0
ZW1wdGVkIHRocm91Z2ggQWxpYmFiYS5jb20gKG5vdCB5b3VyIHVzdWFsIGFjdGl2aXR5KVxuIEFz
IGEgcHJlY2F1dGlvbiwgdGhpcyB0cmFuc2FjdGlvbiBoYXMgYmVlbiB0ZW1wb3JhcmlseSBwbGFj
ZWQgb24gaG9sZC5cbldlIGFsc28gZGV0ZWN0ZWQgYSBsb2dpbiBhdHRlbXB0IGZyb20gYW4gdW5m
YW1pbGlhciBkZXZpY2UgYW5kIGxvY2F0aW9uLlxuIElmIHlvdSByZWNvZ25pemUgdGhpcyB0cmFu
c2FjdGlvbiDigJMgbm8gZnVydGhlciBhY3Rpb24gaXMgcmVxdWlyZWQuXG5JZiBub3QgcmVjb2du
aXplZCDigJMgeW91ciBhY2NvdW50IHdpbGwgYmUgY2hhcmdlZCB3aXRoaW4gdGhlIG5leHQgaG91
ci5cblBsZWFzZSBjb250YWN0IEFwcGxlIFN1cHBvcnQgaW1tZWRpYXRlbHkgYXQgKzEgKDgwMykg
MjM5LTk3MjhcbnRvIGNhbmNlbCBvciBkaXNwdXRlIHRoZSB0cmFuc2FjdGlvbi5cbiBBcHBsZSBT
ZWN1cml0eSAmIEJpbGxpbmcgVGVhbTogKzEgKDgwMykgMjM5LTk3MjhcbiDCqe+4jyAyMDI2IEFw
cGxlIEluY1xuICBcbiAKWC1BTFQtREVTQztGTVRUWVBFPXRleHQvaHRtbDo8cD5Ob3RpY2Ug4oCT
IFN1c3BpY2lvdXMgQWN0aXZpdHkgRGV0ZWN0ZWQgb24gWW91ciBBcHBsZSBBY2NvdW50PC9wPiA8
cD5EZWFyIEN1c3RvbWVyLDwvcD4gPHA+V2UgaGF2ZSBpZGVudGlmaWVkIGEgJDE5OSB0cmFuc2Fj
dGlvbiBvbiB5b3VyIEFwcGxlIElEIHRoYXQgYXBwZWFycyBhYm5vcm1hbC48L3A+IDxwPlRyYW5z
YWN0aW9uIERldGFpbHM6PGJyLz5QdXJjaGFzZSBhdHRlbXB0ZWQgdGhyb3VnaCBBbGliYWJhLmNv
bSAobm90IHlvdXIgdXN1YWwgYWN0aXZpdHkpPC9wPiA8cD5BcyBhIHByZWNhdXRpb24sIHRoaXMg
dHJhbnNhY3Rpb24gaGFzIGJlZW4gdGVtcG9yYXJpbHkgcGxhY2VkIG9uIGhvbGQuPGJyLz5XZSBh
bHNvIGRldGVjdGVkIGEgbG9naW4gYXR0ZW1wdCBmcm9tIGFuIHVuZmFtaWxpYXIgZGV2aWNlIGFu
ZCBsb2NhdGlvbi48L3A+IDxwPklmIHlvdSByZWNvZ25pemUgdGhpcyB0cmFuc2FjdGlvbiDigJMg
bm8gZnVydGhlciBhY3Rpb24gaXMgcmVxdWlyZWQuPGJyLz5JZiBub3QgcmVjb2duaXplZCDigJMg
eW91ciBhY2NvdW50IHdpbGwgYmUgY2hhcmdlZCB3aXRoaW4gdGhlIG5leHQgaG91ci48YnIvPlBs
ZWFzZSBjb250YWN0IEFwcGxlIFN1cHBvcnQgaW1tZWRpYXRlbHkgYXQgPHN0cm9uZz4rMSAoODAz
KSAyMzktOTcyODwvc3Ryb25nPjxici8+dG8gY2FuY2VsIG9yIGRpc3B1dGUgdGhlIHRyYW5zYWN0
aW9uLjwvcD4gPHA+QXBwbGUgU2VjdXJpdHkgJmFtcDsgQmlsbGluZyBUZWFtOiA8c3Ryb25nPisx
ICg4MDMpIDIzOS05NzI4PC9zdHJvbmc+PC9wPiA8cD7Cqe+4jyAyMDI2IEFwcGxlIEluYzwvcD4g
PHA+Jm5ic3A7PC9wPiAKRFRTVEFSVDtUWklEPUV1cm9wZS9IZWxzaW5raToyMDI2MDgxNFQyMDAw
MDAKRFRFTkQ7VFpJRD1FdXJvcGUvSGVsc2lua2k6MjAyNjA4MTRUMjAzMDAwCkxPQ0FUSU9OOgpV
SUQ6ZjI4YzY2M2NjOTM0NGNkOWJhN2Q2NDRmOWU5OTZkZDdAem9oby5ldQpJTVBPUlRBTlQ6MApD
TEFTUzpQVUJMSUMKU1RBVFVTOkNPTkZJUk1FRApUUkFOU1A6T1BBUVVFClBSSU9SSVRZOjAKQ1JF
QVRFRDoyMDI2MDgxNFQxNjQwNTNaCkxBU1QtTU9ESUZJRUQ6MjAyNjA4MTRUMTY0MDUzWgpEVFNU
QU1QOjIwMjYwODE0VDE2NDA1NFoKT1JHQU5JWkVSO0NOPWhxeW9ucHJqLjcyMzk5NTc6TUFJTFRP
OmhxeW9ucHJqLjcyMzk5NTdAem9ob21haWwuZXUKQVRURU5ERUU7Q1VUWVBFPUlORElWSURVQUw7
Uk9MRT1SRVEtUEFSVElDSVBBTlQ7UlNWUD1UUlVFO1BBUlRTVEFUPU5FRURTLUFDVElPTjpNQUlM
VE86ZG9jdG9yQGRvY3Rvci5ubDJrLmFiLmNhCkJFR0lOOlZBTEFSTQpBQ1RJT046RU1BSUwKVFJJ
R0dFUjtWQUxVRT1EVVJBVElPTjtSRUxBVEVEPVNUQVJUOi1QVDE1TQpFTkQ6VkFMQVJNCkVORDpW
RVZFTlQKRU5EOlZDQUxFTkRBUgo=
------=_Part_24757064_2042309305.1786725655228--